ssl：httpd的运用

ssl：

启用模块：编辑/etc/httpd/conf.modules.d/00-base.conf文件，添加下面这行，如果已经有了但是注释了，则取消注释即可

LoadModule ssl_module modules/mod_ssl.so
配置https步骤：

生成证书：

证书有3种

1. 自己生成（只用于实验，内网）

2. https://www.freehao123.com/lets-encrypt/（免费证书，有期限，不建议，个人网站）

3. 公司买的
   openssl实现私有CA：

   CA的配置文件：/etc/pki/tls/openssl.cnf

a) CA生成一对密钥

[root@yeqixian1 ~]# setenforce 0
[root@yeqixian1 ~]# systemctl disable firewalld
[root@yeqixian1 conf.d]# cd /etc/pki/CA
[root@yeqixian1 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) #生成密钥，括号必须要
Generating RSA private key, 2048 bit long modulus
…+++
…+++
e is 65537 (0x10001)
[root@yeqixian1 CA]# openssl rsa -in private/cakey.pem -pubout #提取公钥（可以不用）
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxkXkZp1DQvW8h5r3Rj4Y
F+p6p4LXAxcLay7N0AsdTADyrWguo79AtUxxuxv877qhir80rAj1yK/r+US6caK0
nqWmak3vYM0MWdq+OcbR3x36bvlFy+YB2tVIc57Uahx7aWrA1OuABw60LKmabPKk
8JkaEyfhCgu7gCflyUNSLTWeXEjfZ2ZmZn2vYAC4AOQZkwADGlGISDEcRfuAk4pJ
ELBq5reaTNdHkhvsj36TAnheHsojlcDL46Nd5PFVnWRxazx/ad/90NWxaW7wY5qD
AUsXJBS4qYhlIT4dHyHJBVA03sN6RP4rsW98+0ACgPbO6gCitmalYtcHmuFpqBkV
6wIDAQAB

b) CA生成自签署证书

[root@yeqixian1 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 #生成自签署证书（不能错）
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN（国家）
State or Province Name (full name) []:HB（省份）
Locality Name (eg, city) [Default City]:WH（城市）
Organization Name (eg, company) [Default Company Ltd]:www.a.com（真实域名）
Organizational Unit Name (eg, section) []:www.a.com
Common Name (eg, your name or your server's hostname) []:www.a.com
Email Address []:1@2.com（真实邮箱）    

openssl x509 -text -in cacert.pem #读出cacert.pem证书的内容（不用做）
mkdir certs newcerts crl（默认有，不用做）
[root@yeqixian1 CA]# ls
cacert.pem certs crl newcerts private
touch index.txt && echo 01 > serial
[root@yeqixian1 CA]# touch index.txt &&